Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, UserController::upsertUser() in src/Core/Framework/Api/Controller/UserController.php writes raw user data in SYSTEM_SCOPE without filtering the admin field, so a non‑admin API user with user:create or user:update ACL permission can set admin: true on new or existing users; IntegrationController::upsertIntegration() contains an isAdmin() check for the same field, but UserController was missing this check. This issue is fixed in versions 6.6.10.18 and 6.7.10.1.

Shopware Platform and Shopware Shopware products running versions prior to 6.6.10.18 and 6.7.10.1 are vulnerable. The issue affects all installations that use the default UserController code, regardless of specific module configuration.

The CVSS score is 6.5, indicating medium impact. The EPSS score of less than 1% suggests exploitation is unlikely at present, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is a remote REST API request to UserController::upsertUser. An attacker must have network access to the API and an account granted either user:create or user:update ACLs. The exploit can be performed by crafting a payload that sets the admin flag, thereby granting administrative rights to the attacker. While the vulnerability requires privileged API access, it provides a powerful tool for full system compromise once the attacker is on the network.